DATA PROTECTION & DATA HANDLING POLICY

1. SCOPE & APPLICATION

This Policy applies to:

• All personal data of Users (Buyers and Vendors) collected through the Platform
• Personal data of Vicsmall employees and contractors processed for employment purposes
• Personal data processed by Vicsmall as a Data Processor on behalf of Vendor Data Controllers
• Cross-border data transfers in connection with importation/wholesale activities

2. DATA GOVERNANCE STRUCTURE

2.1 Data Protection Officer (DPO)

Vicsmall has appointed a Data Protection Officer responsible for overseeing compliance with this Policy, the NDPA, and all applicable data protection legislation. The DPO reports directly to senior management and may be contacted at dpo@vicsmall.com.

2.2 Data Controller vs Data Processor

Vicsmall acts as Data Controller in respect of data it collects from platform Users. Where Vicsmall processes data on behalf of Vendors (e.g., storing Vendor customer lists for order management purposes), it acts as a Data Processor and will enter into a Data Processing Agreement (DPA) with each such Vendor.

3. DATA CLASSIFICATION

4. DATA COLLECTION PRINCIPLES

All personal data collected by Vicsmall must satisfy the following principles (Section 24, NDPA 2023):

• Lawfulness, fairness and transparency: data is processed on a lawful basis and in a manner transparent to the data subject
• Purpose limitation: data is collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes
• Data minimisation: only data that is adequate, relevant, and limited to what is necessary is collected
• Accuracy: reasonable steps are taken to ensure data is accurate and kept up to date
• Storage limitation: data is not retained longer than necessary
• Integrity and confidentiality: appropriate security measures are maintained
• Accountability: Vicsmall maintains records of processing activities and demonstrates compliance

5. DATA PROCESSING REGISTER

Vicsmall maintains a Register of Processing Activities (ROPA) documenting all categories of personal data processed, the purposes of processing, data recipients, retention periods, and security measures. The ROPA is reviewed and updated at least annually by the DPO, and is available to the NDPC upon request.

6. DATA SUBJECT REQUEST PROCEDURE

Requests to exercise data subject rights are handled as follows:

1. Submit request by email to privacy@vicsmall.com with proof of identity
2. Vicsmall acknowledges receipt within 5 business days
3. Vicsmall responds substantively within 30 days (extendable by a further 60 days for complex requests, with notice to the requestor)
4. Requests that are manifestly unfounded or excessive may be declined or charged a reasonable fee, with written reasons provided
5. Refusals may be appealed to the NDPC

7. DATA BREACH MANAGEMENT

Vicsmall maintains a Data Breach Response Plan. Upon becoming aware of a breach:

1. Immediate containment measures are activated within 1 hour of discovery
2. Internal escalation to the DPO and senior management within 2 hours
3. Assessment of risk to affected data subjects within 12 hours
4. Notification to the NDPC within 72 hours of becoming aware of the breach (where the breach is likely to result in a risk to data subjects' rights)
5. Notification to affected data subjects without undue delay where the breach is likely to result in a high risk to their rights and freedoms
6. Full incident report documented within 7 days

8. DATA PROCESSING AGREEMENTS (DPAs)

Where Vicsmall engages third-party processors (e.g., cloud hosting providers, analytics firms, payment processors), a written DPA is executed prior to any processing, incorporating: the subject matter and duration of processing; the nature and purpose of processing; the type of personal data; the categories of data subjects; and the obligations and rights of the Data Controller — all as required by Schedule 2 of the NDPA 2023.

9. TRAINING & AWARENESS

All Vicsmall staff and contractors with access to personal data undergo mandatory data protection training upon onboarding and at least annually thereafter. Non-compliance with this Policy may result in disciplinary action.

10. VICSMALL PRIME, CUSTOMER DELIVERY ADDRESS & SELLER CONTACT SHARING

When a customer places an order, Vicsmall shares the shipping address provided for that order (street, city, state and country) with only the independent seller or sellers whose products are in that order. This includes orders awaiting payment and does not require a Prime membership. The purpose is order handling and fulfilment; Vicsmall continues to manage delivery. Order ownership is checked before an address is displayed. This necessary order-related processing is carried out for performance of the customer purchase contract.

Customer telephone numbers and email addresses are different from delivery addresses. They are not included in general seller order details. A seller can access these contact details through Vicsmall only while holding an active, paid and verified Prime Seller membership, for an order involving that seller, and only where the customer has separately opted in to contact sharing. A customer's own Prime membership does not automatically disclose contact details.

Contact-sharing consent is optional and is not required to register, purchase or receive delivery. Customers can opt in during account creation or change or withdraw their choice in their Prime account privacy settings. Changes apply to future access via Vicsmall; they cannot undo details already viewed. Vicsmall records consent choices and the first seller disclosure for auditing. Seller contact access is limited to order-related communication and fulfilment, not marketing, resale or unrelated approaches.

Prime subscriptions use Paystack for recurring billing and payment confirmation. Vicsmall processes membership type, payment references, payment verification, billing status, subscription period and receipts to manage access, renewals and cancellation. Vicsmall does not grant paid benefits based solely on a payment redirect; its server verifies payment with Paystack. Customers with active and verified Prime Customer memberships may receive Vicsmall-funded quoted shipping on eligible orders, including standard, express and international delivery. Customs duties and separately assessed taxes are not included in that benefit.

Access to order data and Prime billing records is restricted to the relevant accounts and authorised staff, retained in line with applicable legal, payment, dispute and accounting obligations. Requests concerning personal data, including access, correction or consent withdrawal, may be sent to privacy@vicsmall.com.

11. POLICY REVIEW

This Policy is reviewed by the DPO at least annually or following any material change in applicable legislation, regulatory guidance, or Vicsmall's processing activities.